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REMARKS 

The Examiner is thanked for the indication of allowable subject matter. 

The Examiner has rejected Claims 1 , 8, 10-14, 20, 21, 23-29 and 31 under 35 
U.S.C. 103(a) as being unpatentable over Radatti (U.S. Patent Application No. 
2002/01 70052) in view of Corman et al. (Introduction to Algorithms, the MIT Press, 
1986, Section 5.5, pp. 91-9? and Chapter 13, pp. 244-262). Applicant respectfully ' 
disagrees with such rejection. 

With respect to each of the independent claims, the Examiner has relied on the 
following excerpts from Radatti to make a prior art showing of applicant's claimed 
"combining the list of virus signatures into a tree of virus signatures" and "wherein a 
portion of the branches corresponds to a plurality of the virus signatures" (see this or 
similar, but not identical, language in each of the foregoing claims). 

"Further description on these fields is presented below There 

embodLr! ° r ™ Ce ° f tbw ^ate_indexfiies in vartous 
embodiments. For example, in certain embodiments, a number of 
software products may be present on the compute- system and Leh 

other C Lr^- haVe ° Wn U P da ^index fH.. Al ir 2 ^ 

other embodiments, one apdate_index file may contain ^formation 
on more than one software product. In yet other em^odlmSs £he 
update_index may refer to other update index files This 
referential u P date_index file structuri may oroide a 

Seffnf ° al Structure and «se a single update index file to 

define an entire set of liles for updates." [0034] ~ 

"Further description on these fields is presented below There 
may oe one or more of these update index files in various 
embodiments. For exa raple , in certain embodiments? Tnu^er of 
so.t^are proaucts may be present on the server and each product 
e^ aVe J" ° Wn u P date -" d ^ file. Alternatively, in oth« 
embodiments, one update_index file may contain information on 
server ^!? 6 S °5 tware Product . In yet other embodiments? the 

Je-erentSt uod2f eX ' W H" t0 ° ther «*a»t._ind.x files. This 

re.erential upaate_mdex tile structure may provide a 

hierarchical tree structure and use one update index \o e to 

define an entire set of files for updates." [0047] 

Applicant respectfully asserts that providing a hierarchical tree structure of update 
indexJUes does not meet applicant's claimed "list of virus signatures into a tree of virus 
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signatures" or "portion of the branches corresponds to a plurality of the virus signatures/ 3 
An update index file, as in Radatti, is simply comprised of a module name, a file name, a 
version, a processing flag, a comment, and a hash (see [0025]). 

While Radatti does mention updating in the context of antivirus software (see 
[0005]), the hierarchical tree structure disclosed in Radatti is implemented at a "macro"- 
level, namely with update index files which are each associated with one or more 
software products (as noted above). There is simply not even a suggestion of any sort of 
tree implemented with respect to the content of the update index fdes, let alone a tree 
implemented in the specific context of virus signature, as claimed above. In fact, Radatti 
teaches away from such claimed technique by virtue of the disclosure of update index 
files associated with one or more software products. 

The Examiner has also stated that applicant's claimed '"tree [that] includes a 
plurality of branches each including a sequence of characters" would have been obvious 
in view of the nature of a tree. Again, applicant respectfully disagrees, since Radatti's 
tree is comprised of entire update files and not a sequence of characters of virus 
signatures. 

Further, the Examiner has relied on Corman's teaching of search time advantages 
of binary search trees to meet applicant's claimed technique 'Svherein the efficiency of 
the virus signature recognition is improved by reducing an amount of virus signature data 
that is compared against the data" (see this or similar, but not identical, language in each 
of the foregoing claims). Applicant respectfully asserts that although a binary search tree 
gives search time advantages, such teaching only relates to general binary trees, and not 
to allowing for a reduced amount of virus signature data that is compared against data for 
virus signature recognition. 

Applicant also brings to the Examiner's attention the following claim language 
not addressed by the Examiner: 4t wherein the branches include further sub-branches each 
corresponding to at least one virus signature" (see this or similar, but not identical, 
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language in each of the foregoing claims). This and the aforementioned deficiencies 
noted in the Examiner's rejection arc clearly rooted in the fact that only applicant teaches 
and claims the use of a tree of virus signatures, in the claimed manner, to improve virus 
scanning. Applicant respectfully requests a specific prior art showing of all of applicant's 
claim limitations, in combination with the remaining claim elements. 

To establish a prima facie case of obviousness, three basic criteria must be met. 
First, there must be some suggestion or motivation, either in the references themselves or 
in the knowledge generally available to one of ordinary skill in the art, to modify the 
reference or to combine reference teachings. Second, there must be a reasonable 
expectation of success. Finally, the prior art reference (or references when combined) 
must teach or suggest all die claim limitations. The teaching or suggestion to make the 
claimed combination and the reasonable expectation of success must both be found in the 
prior art and not based on applicant's disclosure. In re Vaeck947 F.2d 488, 20 USPQ2d 
1438 (Fed.Cir. 1991). 

Applicant respectfully asserts that at least the third element of the prima facie 
case of obviousness has not been met, since the prior art references, when combined, fail 
to teach or suggest all of the claim limitations, as noted above. A notice of allowance or 
a specific prior art showing of all of applicant's claim limitations, in combination with 
the remaining claim elements, is respectfully requested. 

The Examiner's rejections are also deficient with respect to the dependent claims. 
For example, with respect to dependent Claim 8 et al. and 29, it appears that the 
Examiner relies on Radatti's update_hash file ([0024]-[0033]) to make a prior art 
showing of applicant's claimed "wherein the characters of the tree of virus signatures are 
obfuscated to prevent detection by the comparison" and "wherein the obfuscation 
prevents accidental self-detection of the tree of virus." Applicant respectfully asserts that 
Radatti merely teaches hashing update files in the tree, but does not teach ' Virus 
signatures [that] are obfuscated to prevent detection by the comparison" let alone where 
such "obfuscation prevents accidental self-detection," as claimed by applicant. 
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With respect to dependent Claim 12 et al., the Examiner has stated that 
applicant's claimed technique "wherein a virus signature is determined to be recognized 
upon the successful comparison of the data against an entirety of at least one branch that 
includes all of the characters of one o l the virus signatures" is the nature of the tree walk 
of a search tree. Applicant respectfully asserts that such assertion does not take into full 
consideration applicant's specific claim language. The nature of a tree walk simply does 
not rise to the level of specificity of including a virus signature that is recognized in data 
upon « c^^fiil ™mnarison of the data against an entirety of at least one branch (note 
claims). 

With respect to dependent Claim 1 3 et al., and similar subject matter in 
independent Claim 28, the Examiner has. simply dismissed applicant's claimed technique 
therein data is eligible to be declared clean upon the unsuccessful comparison of the 
data against an entirety of at least one branch that includes all of the characters of one of 
the virus signatures" as being in the nature of a search tree. Applicant respectfully asserts 
that it is not inherent in a tree that once an unsuccessful comparison is made of data 
against an entirety of at least one branch of a tree that includes at least one virus 
signature, the data is eligible to be declared clean. In addition, since Radatti also does not 
teach a tree of virus signatures wherein going down the tree of virus signatures 
determines whether a virus is in data, but instead only teaches a tree of update files for 
improved updating, applicant respectfully asserts that such claim language would also not 
be obvious. 

Again, these and the aforementioned deficiencies noted in the Examiner's 
rejection are clearly rooted in the fact that only applicant teaches and claims the use of a 
tree of virus signatures, in the claimed manner, to improve virus scanning. A notice of 
allowance or a specific prior art showing of each of the foregoing limitations, in 
combination with the remaining claim elements, is respectfully requested. 
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To this end, all of the pending independent claims are deemed allowable, along 
with any dependent claims depending therefrom. 

Reconsideration is respectfully requested. 

In the event a telephone conversation would expedite the prosecution of this 
application, the Examiner may reach me undersigned at (408) 505-5100. Applicants are 
enclosing a check to pay for the added claims. The Commissioner is authorized to charge 
any additional fees or credit any overpayment to Deposit Account No. 50-1351 (Order 
No. NAI1P016). 

RespectfuUy_subrpjtted, 
Zitka-Kotab/pC 



KyJmJ. Zilk'a 
J&gisti ation No. 41,429 




P.O. Box 721 120 / ^ 
San Jose, CA 95172-1 \T*r 
408-505-5100 
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